OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which
    allows remote authenticated users to retain the privileges of the revoked roles. (CVE-2012-4413)

- Require authz to update user's tenant (CVE-2012-3542)

    - Delete user tokens after role grant/revoke       (CVE-2012-4413)

    - Fails to validate tokens in Admin API (CVE-2012-4456)

    - Fails to raise Unauthorized user error for disabled       tenant (CVE-2012-4457)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dolph Mathews discovered that when roles are granted and revoked to users in Keystone, pre-existing tokens were not updated or invalidated to take the new roles into account. An attacker could use this to continue to access resources that have been revoked.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
474182	Chainguard: openstack-keystone-2025.2-fips: security update to 28.0.1_git20260610-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
474182	Chainguard: openstack-keystone-2025.2-fips: security update to 28.0.1_git20260610-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
417129	SCA: security update for keystone (GHSA-mrxv-65rv-6hxq)	Tenable Cloud Security	SCA Checks	Local	high
417129	SCA: security update for keystone (GHSA-mrxv-65rv-6hxq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
62417	Fedora 17 : openstack-keystone-2012.1.2-4.fc17 (2012-13075)	Nessus	Fedora Local Security Checks	Local	high
62072	Ubuntu 12.04 LTS : keystone vulnerability (USN-1564-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2012-4413

high

Tenable Plugins

high

high

high

high

high

medium